CVE-2023-0767

High

Advisory

Published 15 Feb 2023In the index since 5 Sept 2026

Severity: High; worst across findings
CVSS: 8.8; base score, highest
EPSS: 0.008; 55th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 105; of 17,781 indexed, latest versions
Container images: 103; deployed by those charts
Fix available: 2 of 3; affected packages

Red Hat Security Advisory: nss security update

Carried by container images the latest versions of 105 of 17,781 indexed charts deploy, on 103 images.

Affected package	Affected versions	Fixed in	Images
nssdeb	2:3.17.1-0ubuntu0.14.04.1, 2:3.28.4-0ubuntu0.14.04.3, 2:3.28.4-0ubuntu0.16.04.3, 2:3.28.4-0ubuntu0.16.04.4+16 more	2:3.28.4-0ubuntu0.14.04.5+esm12, 2:3.28.4-0ubuntu0.16.04.14+esm4, 2:3.35-2ubuntu2.16, 2:3.49.1-1ubuntu1.9+2 more	53
nssrpm	3.36.0-7.1.el7_6, 3.44.0-4.el7, 3.44.0-7.el7_7, 3.53.1-3.el7_9+5 more	0:3.79.0-5.el7_9, 0:3.79.0-11.el8_7	49
mozjs68deb	68.6.0-1ubuntu1	no fix listed	1

OSV records: RHSA-2023:1252 RHSA-2023:1332 UBUNTU-CVE-2023-0767 DSA-5353-1
Also known as: RHSA-2023:1369, RHSA-2023:1370, USN-5892-1, USN-5892-2

Charts affected

105 by stars

Chart

Latest

Affected images

Radar Score

hermestouk

0.6.0

1 of 3 See more

hermes touk 0.6.0

1 of the 3 container images this version deploys carry CVE-2023-0767.

Container image	Digest	Package	Fixed in
apicurio/apicurio-registry-kafkasql :2.1.0.Final	a97d67487532	nss@3.53.1-17.el8_3	0:3.79.0-11.el8_7

Open the chart page →

12,455

webhookiewebhookie

0.1.2

1 of 1 See more

webhookie webhookie 0.1.2

1 of the 1 container images this version deploys carry CVE-2023-0767.

Container image	Digest	Package	Fixed in
hookiesolutions/webhookie :latest	0629694246ba	nss@2:3.49.1-1ubuntu1.5	2:3.49.1-1ubuntu1.9

Open the chart page →

14,364

webhookie-allwebhookie

0.1.2

2 of 3 See more

webhookie-all webhookie 0.1.2

2 of the 3 container images this version deploys carry CVE-2023-0767.

Container image	Digest	Package	Fixed in
hookiesolutions/webhookie :latest	0629694246ba	nss@2:3.49.1-1ubuntu1.5	2:3.49.1-1ubuntu1.9
quay.io/keycloak/keycloak :14.0.0	3029dc0f1d38	nss@3.53.1-17.el8_3	0:3.79.0-11.el8_7

Open the chart page →

28,605

workshop-pipelinesworkshop-pipelines

0.1.6

1 of 2 See more

workshop-pipelines workshop-pipelines 0.1.6

1 of the 2 container images this version deploys carry CVE-2023-0767.

Container image	Digest	Package	Fixed in
quay.io/maximilianopizarro/workshop-pipelines :latest	e383ba3e0966	nss@3.67.0-7.el8_5	0:3.79.0-11.el8_7

Open the chart page →

11,577

keycloakxzaks

2.2.0

1 of 1 See more

keycloakx zaks 2.2.0

1 of the 1 container images this version deploys carry CVE-2023-0767.

Container image	Digest	Package	Fixed in
quay.io/keycloak/keycloak :20.0.3	b8f2a453a17a	nss@3.79.0-10.el8_6	0:3.79.0-11.el8_7

Open the chart page →

6,016

Container images carrying it

103 by charts deploying them

A fixed version is listed for 2 of the 3 affected packages.

Container image	Digest	Package	Fixed in	Used by
linuxserver/calibre :version-v5.21.0	a847b5b2d860	nss@2:3.35-2ubuntu2.12	2:3.35-2ubuntu2.16	1
linuxserver/calibre-web :version-0.6.12	938810eca3d3	nss@2:3.49.1-1ubuntu1.5	2:3.49.1-1ubuntu1.9	1
lsstsqre/strimzi-registry-operator :0.4.1	e139fde946d7	nss@2:3.61-1+deb11u1	2:3.61-1+deb11u3	1
mediagis/nominatim :3.7	c15e941485ef	nss@2:3.49.1-1ubuntu1.8	2:3.49.1-1ubuntu1.9	1
omecproject/cdn-antmedia :1.0.0	b4ae7d0d6b74	nss@2:3.35-2ubuntu2.2	2:3.35-2ubuntu2.16	1
openkm/openkm-ce :6.3.11	3bc465a7461b	nss@2:3.49.1-1ubuntu1.8	2:3.49.1-1ubuntu1.9	1
openliberty/open-liberty :javaee8-ubi-min	6f9278b8b2cc	nss@3.44.0-4.el7	0:3.79.0-5.el7_9	1
openliberty/open-liberty :springBoot2-ubi-min	c649524bc428	nss@3.44.0-4.el7	0:3.79.0-5.el7_9	1
openzaak/open-zaak :1.6.0	2ca2ea6e0ae9	nss@2:3.61-1+deb11u2	2:3.61-1+deb11u3	1
opsmx11/issuegen :v2.1.0	5c50ca123d88	nss@2:3.28.4-0ubuntu0.14.04.3	2:3.28.4-0ubuntu0.14.04.5+esm12	1
project2team4/react :latest	3ff031a08887	nss@2:3.49.1-1ubuntu1.6	2:3.49.1-1ubuntu1.9	1
rancher/hardened-calico :v3.13.3	6d2cd61a338b	nss@3.44.0-7.el7_7	0:3.79.0-5.el7_9	1
rancher/hardened-calico :v3.13.3-build20210223	c678c25d47c8	nss@3.53.1-3.el7_9	0:3.79.0-5.el7_9	1
rancher/hardened-cni-plugins :v0.9.1-build20210414	be3c1d469bf7	nss@3.53.1-3.el7_9	0:3.79.0-5.el7_9	1
rancher/hardened-flannel :v0.13.0-rancher1	42784bb38ed3	nss@3.53.1-3.el7_9	0:3.79.0-5.el7_9	1
rancher/hardened-flannel :v0.14.1-build20211022	d6a47d394c03	nss@3.67.0-3.el7_9	0:3.79.0-5.el7_9	1
rancher/hardened-kube-proxy :v1.20.2	d0600143c23c	nss@3.53.1-3.el7_9	0:3.79.0-5.el7_9	1
rancher/hardened-multus-cni :v3.7.1-build20210416	8eb8092f0728	nss@3.53.1-3.el7_9	0:3.79.0-5.el7_9	1
rundeck/rundeck :3.2.7	4d64fe56f767	nss@2:3.28.4-0ubuntu0.16.04.10	2:3.28.4-0ubuntu0.16.04.14+esm4	1
rundeck/rundeck :3.0.16	b13e8059ad72	nss@2:3.28.4-0ubuntu0.16.04.4	2:3.28.4-0ubuntu0.16.04.14+esm4	1
scrapinghub/splash :3.4.1	a5f89bc84606	nss@2:3.35-2ubuntu2.7	2:3.35-2ubuntu2.16	1
sismics/docs :v1.10	f4b0ef019cf1	nss@2:3.35-2ubuntu2.12	2:3.35-2ubuntu2.16	1
tensorflow/tensorflow :1.6.0-devel	1e3172090703	nss@2:3.28.4-0ubuntu0.16.04.3	2:3.28.4-0ubuntu0.16.04.14+esm4	1
thingsboard/tb-coap-transport :3.4.1	bd45a09d85d9	nss@2:3.61-1+deb11u2	2:3.61-1+deb11u3	1
thingsboard/tb-http-transport :3.4.1	a06f53c5e2da	nss@2:3.61-1+deb11u2	2:3.61-1+deb11u3	1
thingsboard/tb-mqtt-transport :3.4.1	030f316ce301	nss@2:3.61-1+deb11u2	2:3.61-1+deb11u3	1
thingsboard/tb-node :3.4.1	645f43b688f7	nss@2:3.61-1+deb11u2	2:3.61-1+deb11u3	1
timescale/timescaledb-ha :pg14.6-ts2.9.1-p1	cdb9ae118899	nss@2:3.68.2-0ubuntu1.1	2:3.68.2-0ubuntu1.2	1
timescale/timescaledb-ha :pg14-ts2.6-latest	ed719c0cd19d	nss@2:3.68.2-0ubuntu1	2:3.68.2-0ubuntu1.2	1
timothyclarke/wptagent :2018-01-23	22c41e5ca7e2	nss@2:3.28.4-0ubuntu0.16.04.3	2:3.28.4-0ubuntu0.16.04.14+esm4	1
viniciusfcf/gitops-quarkus-app-jvm :latest	bba8ee1b5cd5	nss@3.67.0-7.el8_5	0:3.79.0-11.el8_7	1
wavefronthq/proxy :9.2	d1064d28f6eb	nss@2:3.35-2ubuntu2.11	2:3.35-2ubuntu2.16	1
zabbix/zabbix-web-service :ubuntu-6.0.8	ee4baa872280	nss@2:3.68.2-0ubuntu1.1	2:3.68.2-0ubuntu1.2	1
gcr.io/cockroachlabs-helm-charts/cockroach-self-signer-cert :1.3	e225fe7eaa55	nss@3.67.0-4.el7_9	0:3.79.0-5.el7_9	1
ghcr.io/jr0dd/puppeteer :v13.3.2	6047599cd78e	nss@2:3.49.1-1ubuntu1.6	2:3.49.1-1ubuntu1.9	1
ghcr.io/k8s-at-home/network-ups-tools :v2.7.4-2479-g86a32237	cbd5d4cc1245	nss@2:3.49.1-1ubuntu1.5	2:3.49.1-1ubuntu1.9	1
ghcr.io/k8s-at-home/nzbhydra2 :v3.14.2	ef3670f7e0a8	nss@2:3.49.1-1ubuntu1.5	2:3.49.1-1ubuntu1.9	1
ghcr.io/linuxserver/booksonic-air :version-v2009.1.0	baa4fa9549dc	nss@2:3.35-2ubuntu2.13	2:3.35-2ubuntu2.16	1
ghcr.io/lsst-sqre/strimzi-registry-operator :0.6.0	7e25f7048aff	nss@2:3.61-1+deb11u2	2:3.61-1+deb11u3	1
ghcr.io/paperless-ngx/paperless-ngx :1.8.0	9bbc9a90641e	nss@2:3.61-1+deb11u2	2:3.61-1+deb11u3	1
ghcr.io/star-whale/server :0.6.15	8368359c8dd0	nss@2:3.49.1-1ubuntu1.8	2:3.49.1-1ubuntu1.9	1
quay.io/eformat/jenkins-agent-graalvm :latest	a3b9a07648b6	nss@3.53.1-17.el8_3	0:3.79.0-11.el8_7	1
quay.io/fiware/apollo :0.0.10	55330b1b60c1	nss@3.67.0-7.el8_5	0:3.79.0-11.el8_7	1
quay.io/fiware/canis-major :1.5.15	bb40472e4ff5	nss@3.67.0-7.el8_5	0:3.79.0-11.el8_7	1
quay.io/fiware/endpoint-configuration-service :0.4.3	0dc38a87b844	nss@3.67.0-7.el8_5	0:3.79.0-11.el8_7	1
quay.io/fiware/trusted-issuers-registry :0.11.1	a8a9ec461034	nss@3.67.0-7.el8_5	0:3.79.0-11.el8_7	1
quay.io/keycloak/keycloak :14.0.0	3029dc0f1d38	nss@3.53.1-17.el8_3	0:3.79.0-11.el8_7	1
quay.io/keycloak/keycloak :20.0.1	8830f76112b6	nss@3.79.0-10.el8_6	0:3.79.0-11.el8_7	1
quay.io/keycloak/keycloak :20.0.3	b8f2a453a17a	nss@3.79.0-10.el8_6	0:3.79.0-11.el8_7	1
quay.io/keycloak/keycloak-operator :20.0.2	b1710745fa64	nss@3.79.0-10.el8_6	0:3.79.0-11.el8_7	1